unexpected RCODE

[Mark Andrews]

> 
> > In article <dvrvjf$155e$1 at sf1.isc.org>,
> >
> >  Mark Watts <m.watts at eris.qinetiq.com> wrote:
> > > I keep getting the following type of messages in syslog on a bind 9.3.1
> > > box (its an internal dns domain - not visible from outside the network):
> > >
> > > Mar 22 16:34:24 ins0 named[2086]: unexpected RCODE (REFUSED) resolving
> > > 'blog.mq.eris.qinetiq.com/AAAA/IN': 128.98.76.115#53
> > >
> > > I get lots of these, all for machines on the mq.eriq.qinetiq.com domain,
> > > which
> > > should be being delegated to the IP address given.
> >
> > Check the allow-query option on that machine -- apparently it isn't
> > allowing queries from your server.
> 
> I'm a little confused now:
> 
> [root at ins0 ~]# dig blog.mq.eris.qinetiq.com @128.98.76.115
> 
> ; <<>> DiG 9.3.1 <<>> blog.mq.eris.qinetiq.com @128.98.76.115
> ; (1 server found)
> ;; global options:  printcmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61889
> ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
> 
> ;; QUESTION SECTION:
> ;blog.mq.eris.qinetiq.com.      IN      A
> 
> ;; ANSWER SECTION:
> blog.mq.eris.qinetiq.com. 0     IN      A       128.98.76.115
> 
> ;; Query time: 1 msec
> ;; SERVER: 128.98.76.115#53(128.98.76.115)
> ;; WHEN: Thu Mar 23 17:46:26 2006
> ;; MSG SIZE  rcvd: 58
> 
> 
> Looking at the initial error, am I right in thinking its an IPv6 query that i
> s 
> being rejected?
> If so, what might be generating these queries since we don't run any IPv6 
> networks?

	Do you have IPv6 configured on any box in your network?  Lots
	of machines will have ::1 configured in lo0 but no IPv6 on the
	external interfaces.

	The nameserver in question is broken.  The normal response is
	a NOERROR response with no answers in the answer section.
	See RFC 2308 for full details.

	Mark
 
> -- 
> Mark Watts BSc RHCE
> Senior Systems Engineer
> QinetiQ Trusted Information Management
> Trusted Solutions and Services Group
> GPG Public Key ID: 455420ED
> 
> 
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: Mark_Andrews at isc.org